5

I am trying to install Sitecore 9 on Windows Server 2012 R2.

There were some issues while executing Sitecore 9 installation script using SIF related to create self signed certificate for xConnect. Issues can be tracked in my previous question here.

Thus I decided to create this certificate using separate powershell script.

#install client certificate for xconnect 
$Path = "c:\\certificates"
$XConnectCertName = "$prefix.xconnect_client"
$Signer = Invoke-GetCertificateConfigFunction -Id 'DO_NOT_TRUST_SitecoreRootCert' -CertStorePath Cert:\LocalMachine\Root -Verbose
$Signer.GetType()
$DnsName = "$prefix.xconnect_client"
$CertStoreLocation = 'Cert:\LocalMachine\My'
$signedCertificate = New-SelfSignedCertificate -CloneCert $Signer -DnsName $DnsName -CertStoreLocation $CertStoreLocation -Verbose
if ($null -eq $signedCertificate) {

throw "Failed to create signed certificate for '$DnsName' in $CertStoreLocation"
}
Write-Host "Created signed certificate $signedCertificate"


Write-Host "Export new certificate public key as a CRT file"
$exportFilePath = Join-Path -Path $Path -ChildPath "$XConnectCertName.crt"
$exportPFXFilePath = Join-Path -Path $Path -ChildPath "$XConnectCertName.pfx"


$pwd2 = ConvertTo-SecureString -String "123456" -Force -AsPlainText
Export-PfxCertificate -cert $signedCertificate -FilePath $exportPFXFilePath -Password $pwd2


$certificateInfo = Export-Certificate -Cert $signedCertificate -FilePath $exportFilePath -Force

Write-Information -MessageData "Exported signed certificate to $exportFilePath"


Import-PfxCertificate -FilePath $exportPFXFilePath -CertStoreLocation Cert:\LocalMachine\Root -Password $pwd2 -Exportable

After creating self signed certificate for xConnect, I executed the Sitecore installation script. There is much progress in the installation this time but at the end, I got another exception..

Install-SitecoreConfiguration : Unable to parse [ResolveCertificatePath(variable('Security.XConnect.CertificatePath'))] - Exception calling "InvokeWithContext" with "2" argument(s): "The running command stopped because the preference variable "ErrorActionPreference" or common parameter is set to Stop: Certificate Cert:\Localmachine\My\5C6D03D9B5519EC698E50F58B4F9C8DF2E3729FA does not contain Private Key. Ensure that it has been exported with the Private Key."

I already gone through some resolutions mentioned here which is for Windows Server 2016, but this also didn't resolve the issue.

I also tried executing xconnect-createcert.json to create certificate mentioned in the answer.

Install-SitecoreConfiguration -Path C:\sitecore\install\xconnect-createcert.json

But it also doesn't resolve the issue and i am getting same exception at SetCertStorePermissions : FilePermissions step.

Any help would be much appreciated.

Improve this question
2

3 Answers 3

Reset to default
4

The certificate which is used for XConnect must contain a "special" private key. Not any private key will do it.

If you take a closer look at the SIF files, you'll notice, that the Self-Signed Certificate is created in a special way (I'll post only the important parts here):

$xconnectCert = New-SelfSignedCertificate -Type SSLServerAuthentication -TextExtension @( "${extendedKeyUsage}={text}$serverAuthentication,$clientAuthentication" ) `
                          -KeyUsage KeyAgreement, KeyEncipherment, DigitalSignature `
                          -KeyAlgorithm RSA -KeyLength 2048 `
                          -Subject $XConnectCertSubject `
                          -FriendlyName $XConnectCertFriendlyName `
                          -CertStoreLocation $TargetStore `
                          -DnsName $XConnectCertDnsNames `
                          -NotBefore (Get-Date) `
                          -NotAfter (Get-Date).AddYears(1) `
                          -Provider 'Microsoft Enhanced RSA and AES Cryptographic Provider' `
                          -KeyExportPolicy Exportable `
                          -KeyProtection None `
                          -KeySpec KeyExchange `
                          -Signer $rootCertPath

The important part is:

-Provider 'Microsoft Enhanced RSA and AES Cryptographic Provider'
-KeySpec KeyExchange

You can test if your particular certificate will work as client certificate for Sitecore XConnect using the following powershell code snippet:

(Get-ChildItem Cert:\LocalMachine\My\{thumbprint}).PrivateKey

Then powershell should respond with something like this:

PublicOnly           : False
CspKeyContainerInfo  : System.Security.Cryptography.CspKeyContainerInfo
KeySize              : 2048
KeyExchangeAlgorithm : RSA-PKCS1-KeyEx
SignatureAlgorithm   : http://www.w3.org/2000/09/xmldsig#rsa-sha1
PersistKeyInCsp      : True
LegalKeySizes        : {System.Security.Cryptography.KeySizes}

If your certificate returns an output like the one above, your certificate can be used for XConnect. Otherwise, it won't work. Period. Don't ask me about the details behind. I haven't had time to dig into the code.

The second, important thing to note is, that your XConnect website must at least "Accept" client certificates. Open "IIS Management", go to your website > "SSL Settings" and make sure that Client Certificates are allowed.

The third thing to note: Each of your servers, which connects to the Xconnect server will need the XConnect certificate installed, including the private key. The XConnect server itself will need the certificate too. You can see it as kind of a mutual-authentication using a special SSL-Client Certificate.

That's all you need to know about XConnect client certificates. Happy XConnect'ing.

Improve this answer
0

The SSLCert variable should be the IIS site URL. That actually gets created and assigned in IIS for the 443 binding. The XConnectCert var is the name of the XConnect certificate that you want to update. Don't use the thumbprint but the cert name like $prefix.xconnect_client.

Improve this answer
0

Use latest version of Sitecore Installation Framework (SIF) 1.2 which is solving issue with certificate creation on Windows Server 2012 R2.

See release notes here -> https://dev.sitecore.net/Downloads/Sitecore%20Installation%20Framework/1x/Sitecore%20Installation%20Framework%2012/Release%20Notes

SIF 1.2 Download page -> https://dev.sitecore.net/Downloads/Sitecore_Installation_Framework/1x/Sitecore_Installation_Framework_12.aspx

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.